0

I'm currently rebuilding my network infrastructure and am planning to make my NAS available trough an OpenVPN server running on my router for "outside" use (no port forwarding: NAS in private LAN, available trough the VPN).

Now I was wondering about a certain scenario: let's say, I have mapped some of the NAS's drives as network drives via SMB/CIFS in Windows on my laptop (using the local IP address of the NAS in the LAN) or have a proprietary software of the NAS's manufacturer trying to connect to a certain service on a dedicated port.

If I were to take this notebook to an unsecured, public wifi- would this expose the local LAN IP's and/or ports in the CIFS request or the connection request coming from the proprietary software until I'm connected to my VPN (i.e. in the very moment, I'm connecting to the wifi until the VPN tunnel is up)? Does this depend on the way such a request is implemented in the software?

Improve this question
7
  • Even if it would why do you care about exposing your local IP?
    – kevinSpaceyIsKeyserSöze
    Dec 4, 2019 at 14:18
  • I know this sounds like a rather unlikely scenario, but let's say someone hacked (and manipulated) the public network/DHCP server so he could pose as a device with my NAS local IP, wouldn't this mean, that my laptop would try to send data to that device? And as I would think that nobody has tapped into my local network, I would not have set up an encrypted transfer layer/no end-to-end encryption. Wouldn't his mean that the attacker would gain access to unencrypted files sent to this IP address? I'm just wondering if this is an actual attack vector.
    – Dom42
    Dec 4, 2019 at 15:57
  • Maybe but wouldn't you be actively be sending files? I mean your laptop does not just send files to the mapped network drive. You're doing this actively!? And if you're doing it you know at the point when you're sending files, that you're connected to your vpn
    – kevinSpaceyIsKeyserSöze
    Dec 4, 2019 at 16:26
  • The proprietary software I'm talking about would be a "synchronising" software client (comparable to Dropbox just for your private NAS) that would automatically try to sync the files as soon as some kind of network connection would be established. I'm just wondering if the request to connect to a certain IP contains the actual IP in the handshake or if this is protocol/software dependant.
    – Dom42
    Dec 4, 2019 at 16:38
  • I think it could be possible if the software does not athenticate. So your best option would be to disable the software until you're sure you have connected to your vpn,
    – kevinSpaceyIsKeyserSöze
    Dec 4, 2019 at 16:55

1 Answer 1

Reset to default
0

Note: Not exactly an answer to the question asked but side-steps the need to know for the OP.

Answer: You could block the outbound of this application with a host-based firewall for any network adapter besides the virtual adapter of your VPN.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .